Fri, 28 Aug 2009 22:03:11 +0200
Fail if mechanism has already been selected.
894 | 1 | -- sasl.lua v0.4 |
760
90ce865eebd8
Update copyright notices for 2009
Matthew Wild <mwild1@gmail.com>
parents:
702
diff
changeset
|
2 | -- Copyright (C) 2008-2009 Tobias Markmann |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
3 | -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
4 | -- All rights reserved. |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
5 | -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
6 | -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
7 | -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
8 | -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
9 | -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
10 | -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
11 | -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
12 | -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
13 | |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
14 | |
449
c0a4a1e63d70
Completely switched to new hashes library from the old md5 library
Waqas Hussain <waqas20@gmail.com>
parents:
405
diff
changeset
|
15 | local md5 = require "util.hashes".md5; |
38 | 16 | local log = require "util.logger".init("sasl"); |
17 | local tostring = tostring; | |
18 | local st = require "util.stanza"; | |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
19 | local generate_uuid = require "util.uuid".generate; |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
20 | local pairs, ipairs = pairs, ipairs; |
504
efc5184effa1
Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents:
496
diff
changeset
|
21 | local t_insert, t_concat = table.insert, table.concat; |
efc5184effa1
Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents:
496
diff
changeset
|
22 | local to_byte, to_char = string.byte, string.char; |
1485
fbefd16d2955
Move to-unicode conversion from mod_saslauth.lua to sasl.lua.
Tobias Markmann <tm@ayena.de>
parents:
1376
diff
changeset
|
23 | local to_unicode = require "util.encodings".idna.to_unicode; |
38 | 24 | local s_match = string.match; |
277
00c2fc751f50
Fixing some parsing and some other stuff.
Tobias Markmann <tm@ayena.de>
parents:
276
diff
changeset
|
25 | local gmatch = string.gmatch |
280
516f4c901991
Rewrote SASL Digest-MD5 responce generating code, fixed some realm related issue and tested it successfully with Psi. Thanks to dwd, remko and jake.
Tobias Markmann <tm@ayena.de>
parents:
278
diff
changeset
|
26 | local string = string |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
27 | local math = require "math" |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
28 | local type = type |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
29 | local error = error |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
30 | local print = print |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
31 | local setmetatable = setmetatable; |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
32 | local assert = assert; |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
33 | |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
34 | require "util.iterators" |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
35 | local keys = keys |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
36 | |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
37 | local array = require "util.array" |
38 | 38 | module "sasl" |
39 | ||
2173 | 40 | --[[ |
41 | Authentication Backend Prototypes: | |
42 | ||
43 | plain: | |
44 | function(username, realm) | |
45 | return password, state; | |
46 | end | |
47 | ||
48 | plain-test: | |
49 | function(username, realm, password) | |
50 | return true or false, state; | |
51 | end | |
52 | ||
53 | digest-md5: | |
54 | function(username, realm, encoding) | |
55 | return digesthash, state; | |
56 | end | |
57 | ||
58 | digest-md5-test: | |
59 | function(username, realm, encoding, digesthash) | |
60 | return true or false, state; | |
61 | end | |
62 | ]] | |
63 | ||
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
64 | local method = {}; |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
65 | method.__index = method; |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
66 | local mechanisms = {}; |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
67 | local backend_mechanism = {}; |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
68 | |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
69 | -- register a new SASL mechanims |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
70 | local function registerMechanism(name, backends, f) |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
71 | assert(type(name) == "string", "Parameter name MUST be a string."); |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
72 | assert(type(backends) == "string" or type(backends) == "table", "Parameter backends MUST be either a string or a table."); |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
73 | assert(type(f) == "function", "Parameter f MUST be a function."); |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
74 | mechanisms[name] = f |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
75 | for _, backend_name in ipairs(backends) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
76 | if backend_mechanism[backend_name] == nil then backend_mechanism[backend_name] = {}; end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
77 | t_insert(backend_mechanism[backend_name], name); |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
78 | end |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
79 | end |
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
80 | |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
81 | -- create a new SASL object which can be used to authenticate clients |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
82 | function new(realm, profile) |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
83 | sasl_i = {profile = profile}; |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
84 | sasl_i.realm = realm; |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
85 | return setmetatable(sasl_i, method); |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
86 | end |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
87 | |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
88 | -- get a list of possible SASL mechanims to use |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
89 | function method:mechanisms() |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
90 | local mechanisms = {} |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
91 | for backend, f in pairs(self.profile) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
92 | print(backend) |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
93 | if backend_mechanism[backend] then |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
94 | for _, mechanism in ipairs(backend_mechanism[backend]) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
95 | mechanisms[mechanism] = true; |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
96 | end |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
97 | end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
98 | end |
2173 | 99 | self["possible_mechanisms"] = mechanisms; |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
100 | return array.collect(keys(mechanisms)); |
799
b7ea802f3527
Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents:
760
diff
changeset
|
101 | end |
b7ea802f3527
Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents:
760
diff
changeset
|
102 | |
2171
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
103 | -- select a mechanism to use |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
104 | function method:select(mechanism) |
2181
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2180
diff
changeset
|
105 | if self.mech_i then |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2180
diff
changeset
|
106 | return false; |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2180
diff
changeset
|
107 | end |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2180
diff
changeset
|
108 | |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
109 | self.mech_i = mechanisms[mechanism] |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
110 | if self.mech_i == nil then |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
111 | return false; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
112 | end |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
113 | return true; |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
114 | end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
115 | |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
116 | -- feed new messages to process into the library |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
117 | function method:process(message) |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
118 | if message == "" or message == nil then return "failure", "malformed-request" end |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
119 | return self.mech_i(self, message); |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
120 | end |
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
121 | |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
122 | --========================= |
2177 | 123 | --SASL PLAIN according to RFC 4616 |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
124 | local function sasl_mechanism_plain(self, message) |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
125 | local response = message |
2176
8de2f7f5b870
Allow ampersands in passwords for SASL PLAIN mechanism.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
126 | local authorization = s_match(response, "([^%z]+)") |
8de2f7f5b870
Allow ampersands in passwords for SASL PLAIN mechanism.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
127 | local authentication = s_match(response, "%z([^%z]+)%z") |
8de2f7f5b870
Allow ampersands in passwords for SASL PLAIN mechanism.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
128 | local password = s_match(response, "%z[^%z]+%z([^%z]+)") |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
129 | |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
130 | if authentication == nil or password == nil then |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
131 | return "failure", "malformed-request"; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
132 | end |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
133 | |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
134 | local correct, state = false, false; |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
135 | if self.profile.plain then |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
136 | local correct_password; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
137 | correct_password, state = self.profile.plain(authentication, self.realm); |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
138 | if correct_password == password then correct = true; else correct = false; end |
2175
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2174
diff
changeset
|
139 | elseif self.profile.plain_test then |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
140 | correct, state = self.profile.plain_test(authentication, self.realm, password); |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
141 | end |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
142 | |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
143 | self.username = authentication |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
144 | if not state then |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
145 | return "failure", "account-disabled"; |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
146 | end |
2174
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
147 | |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
148 | if correct then |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
149 | return "success"; |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
150 | else |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
151 | return "failure", "not-authorized"; |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2173
diff
changeset
|
152 | end |
2172
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
153 | end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
154 | registerMechanism("PLAIN", {"plain", "plain_test"}, sasl_mechanism_plain); |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2171
diff
changeset
|
155 | |
2177 | 156 | --========================= |
2178
27c7d287345e
Importing SASL Digest-MD5 code.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
157 | --SASL DIGEST-MD5 according to RFC 2831 |
2180 | 158 | local function sasl_mechanism_digest_md5(self, message) |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
159 | --TODO complete support for authzid |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
160 | |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
161 | local function serialize(message) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
162 | local data = "" |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
163 | |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
164 | if type(message) ~= "table" then error("serialize needs an argument of type table.") end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
165 | |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
166 | -- testing all possible values |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
167 | if message["realm"] then data = data..[[realm="]]..message.realm..[[",]] end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
168 | if message["nonce"] then data = data..[[nonce="]]..message.nonce..[[",]] end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
169 | if message["qop"] then data = data..[[qop="]]..message.qop..[[",]] end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
170 | if message["charset"] then data = data..[[charset=]]..message.charset.."," end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
171 | if message["algorithm"] then data = data..[[algorithm=]]..message.algorithm.."," end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
172 | if message["rspauth"] then data = data..[[rspauth=]]..message.rspauth.."," end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
173 | data = data:gsub(",$", "") |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
174 | return data |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
175 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
176 | |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
177 | local function utf8tolatin1ifpossible(passwd) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
178 | local i = 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
179 | while i <= #passwd do |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
180 | local passwd_i = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
181 | if passwd_i > 0x7F then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
182 | if passwd_i < 0xC0 or passwd_i > 0xC3 then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
183 | return passwd; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
184 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
185 | i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
186 | passwd_i = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
187 | if passwd_i < 0x80 or passwd_i > 0xBF then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
188 | return passwd; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
189 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
190 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
191 | i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
192 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
193 | |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
194 | local p = {}; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
195 | local j = 0; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
196 | i = 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
197 | while (i <= #passwd) do |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
198 | local passwd_i = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
199 | if passwd_i > 0x7F then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
200 | i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
201 | local passwd_i_1 = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
202 | t_insert(p, to_char(passwd_i%4*64 + passwd_i_1%64)); -- I'm so clever |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
203 | else |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
204 | t_insert(p, to_char(passwd_i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
205 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
206 | i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
207 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
208 | return t_concat(p); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
209 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
210 | local function latin1toutf8(str) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
211 | local p = {}; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
212 | for ch in gmatch(str, ".") do |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
213 | ch = to_byte(ch); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
214 | if (ch < 0x80) then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
215 | t_insert(p, to_char(ch)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
216 | elseif (ch < 0xC0) then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
217 | t_insert(p, to_char(0xC2, ch)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
218 | else |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
219 | t_insert(p, to_char(0xC3, ch - 64)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
220 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
221 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
222 | return t_concat(p); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
223 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
224 | local function parse(data) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
225 | local message = {} |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
226 | for k, v in gmatch(data, [[([%w%-]+)="?([^",]*)"?,?]]) do -- FIXME The hacky regex makes me shudder |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
227 | message[k] = v; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
228 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
229 | return message; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
230 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
231 | |
2180 | 232 | if not self.nonce then |
233 | self.nonce = generate_uuid(); | |
234 | self.step = 0; | |
235 | self.nonce_count = {}; | |
236 | end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
237 | |
2180 | 238 | self.step = self.step + 1; |
239 | if (self.step == 1) then | |
240 | local challenge = serialize({ nonce = object.nonce, | |
241 | qop = "auth", | |
242 | charset = "utf-8", | |
243 | algorithm = "md5-sess", | |
244 | realm = self.realm}); | |
245 | return "challenge", challenge; | |
246 | elseif (self.step == 2) then | |
247 | local response = parse(message); | |
248 | -- check for replay attack | |
249 | if response["nc"] then | |
250 | if self.nonce_count[response["nc"]] then return "failure", "not-authorized" end | |
251 | end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
252 | |
2180 | 253 | -- check for username, it's REQUIRED by RFC 2831 |
254 | if not response["username"] then | |
255 | return "failure", "malformed-request"; | |
256 | end | |
257 | self["username"] = response["username"]; | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
258 | |
2180 | 259 | -- check for nonce, ... |
260 | if not response["nonce"] then | |
261 | return "failure", "malformed-request"; | |
262 | else | |
263 | -- check if it's the right nonce | |
264 | if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end | |
265 | end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
266 | |
2180 | 267 | if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end |
268 | if not response["qop"] then response["qop"] = "auth" end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
269 | |
2180 | 270 | if response["realm"] == nil or response["realm"] == "" then |
271 | response["realm"] = ""; | |
272 | elseif response["realm"] ~= self.realm then | |
273 | return "failure", "not-authorized", "Incorrect realm value"; | |
274 | end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
275 | |
2180 | 276 | local decoder; |
277 | if response["charset"] == nil then | |
278 | decoder = utf8tolatin1ifpossible; | |
279 | elseif response["charset"] ~= "utf-8" then | |
280 | return "failure", "incorrect-encoding", "The client's response uses "..response["charset"].." for encoding with isn't supported by sasl.lua. Supported encodings are latin or utf-8."; | |
281 | end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
282 | |
2180 | 283 | local domain = ""; |
284 | local protocol = ""; | |
285 | if response["digest-uri"] then | |
286 | protocol, domain = response["digest-uri"]:match("(%w+)/(.*)$"); | |
287 | if protocol == nil or domain == nil then return "failure", "malformed-request" end | |
288 | else | |
289 | return "failure", "malformed-request", "Missing entry for digest-uri in SASL message." | |
290 | end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
291 | |
2180 | 292 | --TODO maybe realm support |
293 | self.username = response["username"]; | |
294 | local password_encoding, Y = self.credentials_handler("DIGEST-MD5", response["username"], self.realm, response["realm"], decoder); | |
295 | if Y == nil then return "failure", "not-authorized" | |
296 | elseif Y == false then return "failure", "account-disabled" end | |
297 | local A1 = ""; | |
298 | if response.authzid then | |
299 | if response.authzid == self.username.."@"..self.realm then | |
300 | -- COMPAT | |
301 | log("warn", "Client is violating XMPP RFC. See section 6.1 of RFC 3920."); | |
302 | A1 = Y..":"..response["nonce"]..":"..response["cnonce"]..":"..response.authzid; | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
303 | else |
2180 | 304 | A1 = "?"; |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
305 | end |
2180 | 306 | else |
307 | A1 = Y..":"..response["nonce"]..":"..response["cnonce"]; | |
308 | end | |
309 | local A2 = "AUTHENTICATE:"..protocol.."/"..domain; | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
310 | |
2180 | 311 | local HA1 = md5(A1, true); |
312 | local HA2 = md5(A2, true); | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
313 | |
2180 | 314 | local KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2; |
315 | local response_value = md5(KD, true); | |
316 | ||
317 | if response_value == response["response"] then | |
318 | -- calculate rspauth | |
319 | A2 = ":"..protocol.."/"..domain; | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
320 | |
2180 | 321 | HA1 = md5(A1, true); |
322 | HA2 = md5(A2, true); | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
323 | |
2180 | 324 | KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2 |
325 | local rspauth = md5(KD, true); | |
326 | self.authenticated = true; | |
327 | return "challenge", serialize({rspauth = rspauth}); | |
328 | else | |
329 | return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated." | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
330 | end |
2180 | 331 | elseif self.step == 3 then |
332 | if self.authenticated ~= nil then return "success" | |
333 | else return "failure", "malformed-request" end | |
2179
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
334 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
335 | end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
336 | |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
337 | return _M; |